Post #1974656

2026-04-30 18:35 UTC

Just looked through the security assessment on the rust rewrite of core utils, and this is why just rewriting everything in the last language is such a dangerous things. They literally threw out 20+ years of security fixes because they thought it was cool and would increase security. At least a security assessment was done, but some of those failures are pretty bad, and very likely to have had serious security implications if they were deployed into any real world system. Setting mode bits incorrectly, TOCTOU, arbitrary file overwrites are just terrible. Would I have likely introduced some of the bugs if I had done the work? Yes. Would I have done the work? No, I&#39;m not that crazy. I do wonder if they did white box or black box when they copied functionality. I&#39;m suspecting black box because of some of the errors. https://github.com/Zellic/publications/blob/master/uutils%20coreutils%20-%20Zellic%20Audit%20Report.pdf

Replies (3)

@bms48@mastodon.social 2026-04-30 18:39

@encthenet@flyovercountry.social I'll try to give #afl ++ a go at #l2ping if I get around to rebooting it. #pcs never got as far as #fuzzing but #Scapy did. time is precious. I might have to drop the ball on committing to fully supporting pcs like I'd talked about with #gnn but I've put cycles in to #upskill my #Python to 2026 already. @lcamtuf@infosec.exchange

Open ##2238388
@bms48@mastodon.social 2026-04-30 18:39

@encthenet@flyovercountry.social fear is the mindkiller https://spectrum.ieee.org/ai-cyberattacks-memory-safe-code?share_id=9439856 UPDATE: Ugh, this somehow turned into a Rust commercial. And they didn't mention the real special sauce once. Got me listening to Grant Lee Buffalo though. MMMM FUZZZEEEE

Open ##2238389
@stiiin@infosec.space 2026-04-30 19:26

@encthenet@flyovercountry.social I recently bought two books by Shigeo Shingō, from the mid-1980s. One of them (Zero Quality Control: Source Inspection and the Poka-Yoke System) consists for a large part of single-page forms explaining factory worker's mistakes causing faulty products, countermeasures taken, the costs involved, and the estimated savings of not shipping faulty products. As I browsed through them, I had a similar realisation: this history isn't just a record of management decisions, or to show off how valuable the quality control is, or how to appreach quality control work, but it is capital. It is know-how that comes with the design of the product. Some of those fixes were as small as "make a little raised lip of metal so that you can't install the switch the wrong way around". But if you'd disassemble the end product and see that bit of metal jut out, you might just think, "huh, that looks useless." A redesign that doesn't also scrutinise all the mistakes that were made is doomed to repeat them.

Open ##2238390